Vaadin : Disable listing of images folder in Vaadin V14 webapp

I have rebuilt the vaadin webapp and removed any Spring functionality. My webapp is now the GreetService starter download for non-spring based apps.

The application runs on a tomcat 9.0 application server with the following config in TOMCAT_HOME/conf/web.xml for directory listings.

<servlet>
    <servlet-name>default</servlet-name>
    <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
    <init-param>
        <param-name>debug</param-name>
        <param-value>0</param-value>
    </init-param>
    <init-param>
        <param-name>listings</param-name>
        <param-value>false</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

There is no other web.xml in the application.

I created an images, icons and testing folder in the src/main/webapp folder of my maven project. The application directory layout is as follows.

I included an empty index.html in two of the folders as Alejandro suggested and just put a simple text file in another.

I build the application into a WAR file using the Production Profile.

The deployed webapp folder on tomcat looks like the following.

All this looks fine and my application works perfectly with the following URL.

However, if I browse to the images folder or icons folder I get a listing of the contents.

I want to stop any listings of any folders at that level. I built the default application starter and deployed it and I get the above behaviour.

I then tried to introduce the following @WebServlet annotation with a @WebInitParam to set the listings to false for this webappp. This has no effect either.

This is the output of my logging from within the service method of my AgentServlet class.

18-12:32:33.620 [https-jsse-nio-8443-exec-10] INFO o.v.e.AgentServlet.service - Request:  Context Path = /myapp-nospring-1.0
, Request URI = /myapp-nospring-1.0/sw.js
, Request URL = https://wfd.sybernet.com:8443/myapp-nospring-1.0/sw.js
, Servlet Context Path = /myapp-nospring-1.0
, Servlet Context Name = null
, Servlet Mapping = /*
, Servlet Mapping Match Value = sw.js
, Servlet Mapping Match Name = PATH
18-12:32:33.623 [https-jsse-nio-8443-exec-10] INFO o.v.e.AgentServlet.service - In AgentServlet ... service().. Listings 
Setting = false
18-12:32:33.625 [https-jsse-nio-8443-exec-10] INFO o.v.e.AgentServlet.lambda$service$0 - 
org.vaadin.example.AgentServlet:org.vaadin.example.AgentServlet
18-12:32:33.626 [https-jsse-nio-8443-exec-10] INFO o.v.e.AgentServlet.lambda$service$0 - default:org.apache.catalina.servlets.DefaultServlet
18-12:32:33.629 [https-jsse-nio-8443-exec-10] INFO o.v.e.AgentServlet.lambda$service$0 jsp:org.apache.jasper.servlet.JspServlet
18-12:32:33.684 [https-jsse-nio-8443-exec-10] DEBUG c.v.f.s.c.UidlWriter.createUidl - * Creating response to client
18-12:32:33.688 [https-jsse-nio-8443-exec-10] DEBUG c.v.f.s.BootstrapHandler.getInitialUidl - Initial UIDL: [object 
Object]

There are three servlets registered - the default one, the jsp one and my one and this is my AgentServlet class with the annotation.

My questions are:-

1. Does the Vaadin servlet allow listings of these folders by default i.e. listings is set to "true" by default. Setting it to false using the web init parameter does not appear to have any effect.

2. Is there something fundamentally wrong with putting folders in the webapp context folder for a Vaadin application i.e. in http://appserver:port/vaadin-web-app/images. If I do this with a JSP application the application behaves as I would expect and the folder contents are not listed. You get a 404 or if the index.html is there it will be presented. I'd be grateful for any comments or suggestions.

    @WebServlet(value = { "/*"}, initParams= 
        {@WebInitParam(name="listings", value="false")}, asyncSupported =true)
    public class AgentServlet extends VaadinServlet {
    /** the logger. */
        private static final Logger MLOGGER = LogManager.getLogger(AgentServlet.class);
   
    @Override
    protected void servletInitialized() throws ServletException {
        super.servletInitialized();
        MLOGGER.info("In AgentServlet ... servletInitialized()");
    }
   
    @Override
    protected void service(HttpServletRequest request, HttpServletResponse response) {
        MLOGGER.info("In AgentServlet ... service()");
        MLOGGER.info("Request:  Context Path = " + request.getContextPath()
        + "\n, Request URI = " + request.getRequestURI()
        + "\n, Request URL = " + request.getRequestURL()
        + "\n, Servlet Context Path = " + request.getServletContext().getContextPath()
        + "\n, Servlet Context Name = " + request.getServletContext().getServletContextName()
        + "\n, Servlet Mapping = " + request.getHttpServletMapping().getPattern()
        + "\n, Servlet Mapping Match Value = " + request.getHttpServletMapping().getMatchValue()
        + "\n, Servlet Mapping Match Name = " + request.getHttpServletMapping().getMappingMatch().name()
            );
   
        String ListingsSetting = getServletConfig().getInitParameter("listings");
        MLOGGER.info("In AgentServlet ... service().. Listings Setting = " + ListingsSetting);
   
   
    request.getServletContext().getServletRegistrations().forEach((key, value) -> MLOGGER.info(key + ":" + value.getClassName()));
   
    try {
        super.service(request, response);
    } catch (ServletException se) {
        MLOGGER.error("In AgentServlet ... service() caught Servlet Exception " +  se.getMessage());
    } catch (IOException ie) {
        MLOGGER.error("In AgentServlet ... service() caught IO Exception " +  ie.getMessage());
    }
   

   } }